internal/runtime/executor/proxy_helpers.go

package executor

import (
	"context"
	"net"
	"net/http"
	"net/url"
	"strings"
	"sync"
	"time"

	"github.com/router-for-me/CLIProxyAPI/v6/internal/config"
	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/auth"
	log "github.com/sirupsen/logrus"
	"golang.org/x/net/proxy"
)

// transportPool caches *http.Transport by proxy URL to reuse connections.
var transportPool sync.Map // key: proxyURL string ("" for no proxy), value: *http.Transport

func getPooledTransport(proxyURL string) *http.Transport {
	if v, ok := transportPool.Load(proxyURL); ok {
		return v.(*http.Transport)
	}

	var t *http.Transport
	if proxyURL == "" {
		t = &http.Transport{}
	} else {
		t = buildProxyTransport(proxyURL)
		if t == nil {
			return nil
		}
	}
	applyTransportDefaults(t, nil)

	actual, _ := transportPool.LoadOrStore(proxyURL, t)
	return actual.(*http.Transport)
}

// newProxyAwareHTTPClient creates an HTTP client with proper proxy configuration priority:
// 1. Use auth.ProxyURL if configured (highest priority)
// 2. Use cfg.ProxyURL if auth proxy is not configured
// 3. Use RoundTripper from context if neither are configured
//
// Parameters:
//   - ctx: The context containing optional RoundTripper
//   - cfg: The application configuration
//   - auth: The authentication information
//   - timeout: The client timeout (0 means no timeout)
//
// Returns:
//   - *http.Client: An HTTP client with configured proxy or transport
func newProxyAwareHTTPClient(ctx context.Context, cfg *config.Config, auth *cliproxyauth.Auth, timeout time.Duration) *http.Client {
	httpClient := &http.Client{}
	if timeout > 0 {
		httpClient.Timeout = timeout
	}

	// Priority 1: Use auth.ProxyURL if configured
	var proxyURL string
	if auth != nil {
		proxyURL = strings.TrimSpace(auth.ProxyURL)
	}

	// Priority 2: Use cfg.ProxyURL if auth proxy is not configured
	if proxyURL == "" && cfg != nil {
		proxyURL = strings.TrimSpace(cfg.ProxyURL)
	}

	// If we have a proxy URL configured, set up the transport
	if proxyURL != "" {
		transport := getPooledTransport(proxyURL)
		if transport != nil {
			applyTransportDefaults(transport, cfg)
			httpClient.Transport = transport
			return httpClient
		}
		log.Debugf("failed to setup proxy from URL: %s, falling back to context transport", proxyURL)
	}

	// Priority 3: Use RoundTripper from context (typically from RoundTripperFor)
	if rt, ok := ctx.Value("cliproxy.roundtripper").(http.RoundTripper); ok && rt != nil {
		if tr, ok := rt.(*http.Transport); ok {
			applyTransportDefaults(tr, cfg)
		}
		httpClient.Transport = rt
	} else {
		// Use pooled default transport for connection reuse
		transport := getPooledTransport("")
		applyTransportDefaults(transport, cfg)
		httpClient.Transport = transport
	}

	return httpClient
}

// buildProxyTransport creates an HTTP transport configured for the given proxy URL.
// It supports SOCKS5, HTTP, and HTTPS proxy protocols.
//
// Parameters:
//   - proxyURL: The proxy URL string (e.g., "socks5://user:pass@host:port", "http://host:port")
//
// Returns:
//   - *http.Transport: A configured transport, or nil if the proxy URL is invalid
func applyTransportDefaults(t *http.Transport, cfg *config.Config) {
	if t == nil {
		return
	}
	maxIdleConns := 100
	maxIdleConnsPerHost := 10
	maxConnsPerHost := 0
	idleConnTimeout := 90 * time.Second
	if cfg != nil {
		if cfg.HTTPTransport.MaxIdleConns > 0 {
			maxIdleConns = cfg.HTTPTransport.MaxIdleConns
		}
		if cfg.HTTPTransport.MaxIdleConnsPerHost > 0 {
			maxIdleConnsPerHost = cfg.HTTPTransport.MaxIdleConnsPerHost
		}
		if cfg.HTTPTransport.MaxConnsPerHost >= 0 {
			maxConnsPerHost = cfg.HTTPTransport.MaxConnsPerHost
		}
		if cfg.HTTPTransport.IdleConnTimeoutSeconds > 0 {
			idleConnTimeout = time.Duration(cfg.HTTPTransport.IdleConnTimeoutSeconds) * time.Second
		}
	}
	t.MaxIdleConns = maxIdleConns
	t.MaxIdleConnsPerHost = maxIdleConnsPerHost
	t.MaxConnsPerHost = maxConnsPerHost
	t.IdleConnTimeout = idleConnTimeout
	if t.ForceAttemptHTTP2 == false {
		t.ForceAttemptHTTP2 = true
	}
}

func buildProxyTransport(proxyURL string) *http.Transport {
	if proxyURL == "" {
		return nil
	}

	parsedURL, errParse := url.Parse(proxyURL)
	if errParse != nil {
		log.Errorf("parse proxy URL failed: %v", errParse)
		return nil
	}

	var transport *http.Transport

	// Handle different proxy schemes
	if parsedURL.Scheme == "socks5" {
		// Configure SOCKS5 proxy with optional authentication
		var proxyAuth *proxy.Auth
		if parsedURL.User != nil {
			username := parsedURL.User.Username()
			password, _ := parsedURL.User.Password()
			proxyAuth = &proxy.Auth{User: username, Password: password}
		}
		dialer, errSOCKS5 := proxy.SOCKS5("tcp", parsedURL.Host, proxyAuth, proxy.Direct)
		if errSOCKS5 != nil {
			log.Errorf("create SOCKS5 dialer failed: %v", errSOCKS5)
			return nil
		}
		// Set up a custom transport using the SOCKS5 dialer
		transport = &http.Transport{
			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
				return dialer.Dial(network, addr)
			},
		}
	} else if parsedURL.Scheme == "http" || parsedURL.Scheme == "https" {
		// Configure HTTP or HTTPS proxy
		transport = &http.Transport{Proxy: http.ProxyURL(parsedURL)}
	} else {
		log.Errorf("unsupported proxy scheme: %s", parsedURL.Scheme)
		return nil
	}

	return transport
}